docs(skills): remove references to tools not installed in the sandbox

Skills and the agent system prompt referenced external CLIs that are not
present in containers/Dockerfile, which could lead the agent to invoke
missing binaries. Replace them with installed equivalents:

- asset_discovery: drop amass/cero and the projectdiscovery tools that are
  not installed (tlsx/dnsx/asnmap/mapcidr/uncover); rewrite around the
  installed subfinder/httpx/naabu plus curl+jq (crt.sh), openssl s_client,
  dig, and whois. Stop claiming the full projectdiscovery suite is available.
- subdomain_takeover: replace dnsx with dig in the pipeline example.
- weak_password_detection: drop hydra/cewl/patator; use ffuf for web logins
  and nmap NSE *-brute scripts for services; fix dead /usr/share/wordlists
  and /usr/share/seclists paths (nothing ships by default -> download to
  /home/pentester/tools/wordlists at runtime).
- system_prompt: replace msfconsole with sqlmap in the interactive-process
  example.

active_directory skill is left as-is: it already ships an explicit install
block for its tools.

strix/agents/prompts/system_prompt.jinja

@@ -188,7 +188,7 @@ EFFICIENCY TACTICS:
   script fail with `ModuleNotFoundError`.
 - `exec_command` runs each command in a fresh non-interactive shell (plain
   pipes, no TTY). To drive an interactive or long-running process with
-  `write_stdin` — REPLs, `ssh`/`nc`/`ftp`, `msfconsole`, or to send Ctrl-C —
+  `write_stdin` — REPLs, `ssh`/`nc`/`ftp`, `sqlmap`, or to send Ctrl-C —
   you MUST start it with `exec_command(cmd="...", tty=true)` and then
   `write_stdin(session_id=<id>, chars="...")`. Calling `write_stdin` on a
   default (non-TTY) command or on a process that has already exited fails with

strix/skills/reconnaissance/asset_discovery.md

@@ -54,18 +54,17 @@ CT logs record nearly every publicly-trusted certificate. Query by domain (match
 
 ## Recommended Tooling
 
-Prefer the projectdiscovery suite (already available in the sandbox and pipeline-friendly with JSON output):
+These tools are available in the sandbox and are pipeline-friendly with JSON output:
 
 - **`subfinder`** — passive subdomain aggregation across many sources incl. CT: `subfinder -d example.com -all -recursive -silent -oJ -o subs.jsonl`
-- **`tlsx`** — TLS/cert data at scale; grab SANs and issuer/org to pivot: `tlsx -l hosts.txt -san -cn -tls-version -json -o tls.jsonl`
+- **`httpx`** — live probing plus cert/SAN grab in one pass: `httpx -l hosts.txt -tls-grab -json` (see methodology).
-- **`uncover`** — query Shodan/Censys/Fofa/Quake/crt.sh engines from one CLI: `uncover -q 'ssl:"Example Inc"' -e shodan,censys,fofa -json`
-- **`asnmap`** — org/domain/ASN → CIDR ranges: `asnmap -d example.com -json` / `asnmap -org "Example Inc"`
-- **`mapcidr`** — expand/aggregate CIDRs into host lists for probing: `mapcidr -cidr 192.0.2.0/24 -o hosts.txt`
-- **`dnsx`** — fast resolution, PTR, and wildcard filtering: `dnsx -l names.txt -a -aaaa -cname -ptr -resp -json -o dns.jsonl`
-- **`httpx`** — live probing + cert grab in one pass (see methodology).
 - **`naabu`** — port sweep for non-HTTP services: `naabu -list hosts.txt -top-ports 100 -verify -silent`
+- **`curl` + `jq`** — direct **crt.sh** JSON queries for CT (no key needed) and other index APIs.
+- **`openssl s_client`** — active read of a live host's cert to extract SANs/CN.
+- **`dig`** / **`nslookup`** — forward/reverse (PTR) resolution and CNAME chains.
+- **`whois`** — ASN/netblock lookups (e.g. `whois -h whois.cymru.com`).
 
-Also useful: **`amass`** (`amass intel`/`enum` for ASN, cert, and passive sources), **`cero`** (bulk SAN extraction from IPs/ranges), and direct **crt.sh** JSON queries when no keys are configured. Cross-source results — CT + passive DNS + `subfinder` together beat any single source.
+Cross-source results — CT + passive DNS + `subfinder` together beat any single source. If you need a tool that is not installed, install it into the sandbox at runtime.
 
 ## Key Techniques
 
@@ -75,7 +74,7 @@ Every new name, PTR result, CNAME target, and cert SAN becomes a fresh seed. Loo
 
 ### Cert-Fingerprint Pivoting
 
-Search Censys/Shodan (or `uncover`) by a cert's `fingerprint_sha256` to find every other host presenting the same certificate — the strongest cross-asset link for tying acquisitions and shadow infra to the target.
+Search Censys/Shodan by a cert's `fingerprint_sha256` to find every other host presenting the same certificate — the strongest cross-asset link for tying acquisitions and shadow infra to the target.
 
 ### Naming-Convention Inference
 
@@ -83,11 +82,11 @@ Wildcard SANs and observed hostnames expose the org's naming scheme; generate ta
 
 ### IP-First Discovery
 
-For ASN-owned ranges, sweep IPs directly with `naabu`/`httpx` and read served certs (`tlsx`) to find services that have no DNS name at all.
+For ASN-owned ranges, sweep IPs directly with `naabu`/`httpx` and read served certs (`httpx -tls-grab`, or `openssl s_client`) to find services that have no DNS name at all.
 
 ## Advanced Techniques
 
-- **Active SAN harvesting** across whole ranges with `tlsx`/`cero` recovers internal hostnames never logged to public CT.
+- **Active SAN harvesting** across whole ranges with `httpx -tls-grab` (or `openssl s_client`) recovers internal hostnames never logged to public CT.
 - **Favicon and response hashing** (`httpx -favicon`, hash pivots in Shodan) clusters instances of the same app across unrelated hostnames.
 - **Vhost differentials**: probe a single IP with multiple `Host:` values to unmask co-located apps behind one address.
 - **Historical CT/DNS diffing** highlights recently issued certs and newly appearing hosts — high-signal for fresh or misconfigured deployments.
@@ -108,11 +107,11 @@ For ASN-owned ranges, sweep IPs directly with `naabu`/`httpx` and read served ce
 ## Testing Methodology
 
 1. **Seed** - domains, org/legal names, known IPs, email domains, code-host org
-2. **Certificate transparency** - pull all logged certs per seed domain and org name (crt.sh, `uncover`)
+2. **Certificate transparency** - pull all logged certs per seed domain and org name (crt.sh, Censys/Shodan)
-3. **SAN/CN extraction** - parse every Subject CN and SAN with `tlsx`; each new name is a new seed
+3. **SAN/CN extraction** - parse every Subject CN and SAN with `httpx -tls-grab` (or `openssl s_client`); each new name is a new seed
-4. **Passive DNS** - resolve forward and reverse with `dnsx`; harvest historical records
+4. **Passive DNS** - resolve forward and reverse with `dig`; harvest historical records
-5. **ASN/IP mapping** - `asnmap` → `mapcidr` to expand owned ranges, then sweep for live hosts
+5. **ASN/IP mapping** - `whois` the netblock/ASN to expand owned ranges, then sweep for live hosts
-6. **Active TLS pivot** - `tlsx`/`cero` on live IPs/ports to grab SANs missing from public CT
+6. **Active TLS pivot** - `httpx -tls-grab` on live IPs/ports to grab SANs missing from public CT
 7. **Consolidate & probe** - dedupe, `httpx` probe, classify, and route to specialists
 
 ## Validation
@@ -139,13 +138,13 @@ For ASN-owned ranges, sweep IPs directly with `naabu`/`httpx` and read served ce
 ## Pro Tips
 
 1. Loop the pipeline — every SAN, PTR, and CNAME target is a new seed until the set converges.
-2. crt.sh is the cheapest high-yield source (no key); Censys/Shodan via `uncover` add cert-fingerprint and vhost pivoting when keys exist.
+2. crt.sh is the cheapest high-yield source (no key); Censys/Shodan add cert-fingerprint and vhost pivoting when keys exist.
-3. Always cert-grab live hosts with `tlsx` — active SANs catch internal hostnames never sent to public CT.
+3. Always cert-grab live hosts with `httpx -tls-grab` (or `openssl s_client`) — active SANs catch internal hostnames never sent to public CT.
 4. Internal-looking SANs (`*.internal`, `*.svc.cluster.local`, staging names) are the highest-signal leads.
 5. Wildcard SANs reveal naming conventions — seed targeted guesses instead of blind brute force.
 6. Cluster by function, not product name, so the workflow generalizes to any exposed service.
-7. Keep JSON output throughout so stages chain cleanly (`subfinder` → `dnsx` → `httpx` → `naabu`).
+7. Keep JSON output throughout so stages chain cleanly (`subfinder` → `dig` → `httpx` → `naabu`).
 
 ## Summary
 
-Broad passive discovery — CT + TLS SAN pivoting + passive DNS + ASN/IP mapping, looped until convergence — finds the assets brute force misses, especially internal-named and forgotten services leaked through certificates. Build the inventory with the projectdiscovery suite, probe and classify it generically, then route each interesting asset to the specialist skill for its class.
+Broad passive discovery — CT + TLS SAN pivoting + passive DNS + ASN/IP mapping, looped until convergence — finds the assets brute force misses, especially internal-named and forgotten services leaked through certificates. Build the inventory with `subfinder`, `httpx`, `naabu`, and CT/DNS/cert queries, probe and classify it generically, then route each interesting asset to the specialist skill for its class.

strix/skills/vulnerabilities/subdomain_takeover.md

@@ -152,7 +152,7 @@ TLS clues: certificate CN/SAN referencing provider default host instead of the c
 
 ## Pro Tips
 
-1. Build a pipeline: enumerate (subfinder/amass) → resolve (dnsx) → probe (httpx) → fingerprint (nuclei/custom) → verify claims
+1. Build a pipeline: enumerate (subfinder) → resolve (dig) → probe (httpx) → fingerprint (nuclei/custom) → verify claims
 2. Maintain a current fingerprint corpus; provider messages change frequently
 3. Prefer minimal PoCs: static "ownership proof" page and, where allowed, DV cert issuance
 4. Monitor CT for unexpected certs on your subdomains

strix/skills/vulnerabilities/weak_password_detection.md

@@ -1,6 +1,6 @@
 ---
 name: weak-password-detection
-description: Weak password detection, credential stuffing, and brute-force testing using common passwords, system-generated credentials, and tooling like Hydra
+description: Weak password detection, credential stuffing, and brute-force testing using common passwords, system-generated credentials, and HTTP fuzzing / NSE brute-force tooling
 ---
 
 # Weak Password Detection / Credential Brute-Force
@@ -98,7 +98,7 @@ Weak or default credentials remain one of the most prevalent and high-impact vul
   - Season + year patterns: `Summer2025!`, `Winter2026@`
   - Keyboard walks and leet speak variations
   - Previously breached passwords for the target domain
-- Cewl: `cewl -d 3 -m 5 -w custom.txt https://target.com` to generate from website content
+- Scrape the target site to build a content-derived wordlist (e.g. a small custom Python crawler that harvests unique words)
 
 ### Credential Stuffing Workflows
 
@@ -123,37 +123,25 @@ Weak or default credentials remain one of the most prevalent and high-impact vul
 
 ### Service-Level Brute-Force
 
-- SSH: `hydra -l admin -P passwords.txt ssh://target.com`
+- HTTP login endpoints: `ffuf` or custom scripts (see Tooling)
-- FTP: `hydra -L users.txt -P passwords.txt ftp://target.com`
+- SSH/FTP/SMB/Telnet and other services: `nmap` NSE `*-brute` scripts, e.g. `nmap -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=passwords.txt target.com`
-- RDP: `hydra -l administrator -P passwords.txt rdp://target.com`
+- Databases (MySQL, PostgreSQL, MongoDB, Redis): weak/default credentials via the matching NSE brute script (`mysql-brute`, `pgsql-brute`, `mongodb-brute`, `redis-brute`) or a custom client script
-- SMB: `hydra -L users.txt -P passwords.txt smb://target.com`
+- Any protocol lacking a ready script: custom Python
-- Database: MySQL, PostgreSQL, MongoDB, Redis with weak credentials
-- API endpoints: `ffuf` or custom scripts for HTTP-based brute-force
 
 ## Tooling
 
-### Hydra (Primary Tool)
+### ffuf (primary for web logins)
-
-- HTTP POST form brute-force:
-  `hydra -l admin -P /usr/share/wordlists/rockyou.txt target.com http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"`
-- Basic Auth:
-  `hydra -L users.txt -P passwords.txt target.com http-get -s 8080 /admin`
-- SSH:
-  `hydra -l root -P passwords.txt -t 4 ssh://target.com`
-- FTP:
-  `hydra -L users.txt -P passwords.txt ftp://target.com`
-- Custom headers and cookies:
-  `hydra ... http-post-form "/api/login:json={\"user\":\"^USER^\",\"pass\":\"^PASS^\"}:F=401"`
-
-### ffuf (HTTP Fuzzing)
 
 - Login brute-force with multiple users and passwords:
   `ffuf -w users.txt:USER -w passwords.txt:PASS -u https://target.com/login -X POST -d "username=USER&password=PASS" -fr "Invalid"`
+- JSON body / custom headers via `-H` and a JSON `-d` payload
 - Filter by response size, status code, or regex to identify successes
 
-### Patator (Versatile Brute-Force)
+### nmap NSE (service brute-force)
 
-- `patator http_fuzz url=https://target.com/login method=POST body='username=FILE0&password=FILE1' 0=user.txt 1=pass.txt -x ignore:fgrep='Invalid'`
+- `*-brute` scripts cover many non-HTTP services:
+  `nmap -p 22 --script ssh-brute --script-args userdb=users.txt,passdb=passwords.txt target.com`
+- Available scripts include `ssh-brute`, `ftp-brute`, `smb-brute`, `telnet-brute`, `mysql-brute`, `pgsql-brute`, `mongodb-brute`, `redis-brute`, `http-brute`, `http-form-brute`.
 
 ### Custom Python Scripts
 
@@ -163,10 +151,10 @@ Weak or default credentials remain one of the most prevalent and high-impact vul
 
 ### Wordlists
 
-- `/usr/share/wordlists/rockyou.txt` (common passwords)
+No password wordlists ship in the sandbox by default — download what you need into `/home/pentester/tools/wordlists` at runtime:
-- `/usr/share/seclists/Passwords/` (organized by category)
+- Common passwords (e.g. `rockyou.txt`) from its upstream source
-- `/usr/share/seclists/Passwords/Default-Credentials/` (vendor defaults)
+- SecLists `Passwords/` and `Passwords/Default-Credentials/` (vendor defaults) from https://github.com/danielmiessler/SecLists
-- Custom lists from Cewl, CeWL, or target-specific scraping
+- Custom lists from target-specific scraping
 - Breach compilation subsets filtered by target relevance
 
 ## Validation
@@ -204,7 +192,7 @@ Weak or default credentials remain one of the most prevalent and high-impact vul
 6. Check for concurrent session limits; successful logins may kick out legitimate users
 7. GraphQL batching can test multiple credentials in a single request, bypassing per-request limits
 8. Document the password policy and recommend minimum standards (length, complexity, breach checking)
-9. When Hydra is unavailable, use ffuf or custom scripts with equivalent logic
+9. For web logins prefer `ffuf`; for other services use `nmap` NSE `*-brute` scripts or custom scripts with equivalent logic
 10. Combine with MFA testing: weak passwords plus missing MFA is a critical finding
 
 ## Summary